don't allow users called 'anyone' or 'anonymous'

They're specialcased in the ACL code, so it would be bad to be that
user.